Mitre ATT&CK view added to SandBlast Agent Forensic reports available in upcoming E81.40

Tom_Kendrick — Fri, 20 Sep 2019 12:51:46 GMT

One of the many new features that will be available in E81.40 is an updated SandBlast Agent Forensic report.

For this, we have to thank our wonderful R&D Team at HQ for making this happen!

The new Forensic report contains:

Mitre ATT&CK screen: Showing links back to the Framework
RDP Focus: Use the Ryuk RDP Report (Overview and General Screen provide RDP Details)
Injections: Use the Ryuk RDP Report (Shown in both Mitre Screen and Tree Views)
Privilege Escalation: Use Cerber or Sodinokibi (Shown in both Mitre Screen and Tree Views)
Current Ransomware affecting US Municipalities: Ryuk, Sodinokibi and Robinhood

Some of these samples have been put online, which you can take a look at:

Report	Use Case	Link
Ryuk RDP	RDP/Injections	https://forensics.checkpoint.com/ryuk_rdp/
Sodinokibi	Ransomware Current	https://forensics.checkpoint.com/sodinokibi/
Robinhood	Ransomware Current	https://forensics.checkpoint.com/robinhood/
Astaroth	Fileless Current	https://forensics.checkpoint.com/astaroth/
Bad Rabbit	Blog / Well Known Ransomware	https://forensics.checkpoint.com/badrabbit/
Cerber	Blog / Well Known Ransomware	https://forensics.checkpoint.com/badrabbit/
Pokemongo	Blog	https://forensics.checkpoint.com/pokemongo/
CTB-Faker	Blog	https://forensics.checkpoint.com/ctb-faker/
Wannacry	Blog/ Well Known Ransomware	https://forensics.checkpoint.com/wannacryptor2_1/
Ranscam	Blog/ Well Known Ransomware	https://forensics.checkpoint.com/ranscam/

topic Mitre ATT&CK view added to SandBlast Agent Forensic reports available in upcoming E81.40 in Endpoint